cliodot 1.2.2 → 1.2.4

package/dist/OAuthAppClient.js

@@ -1 +1,269 @@
-'use strict';const _0x1184f5=_0x1d39;function _0x1d39(_0x1e263f,_0x11a18a){_0x1e263f=_0x1e263f-0x1ad;const _0x227514=_0x2275();let _0x1d3981=_0x227514[_0x1e263f];if(_0x1d39['vThYtI']===undefined){var _0x26d495=function(_0x3fbffc){const _0x52a3dd='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2f6f26='',_0x3c505c='';for(let _0x66c948=0x0,_0x334281,_0x39cff3,_0x239e7f=0x0;_0x39cff3=_0x3fbffc['charAt'](_0x239e7f++);~_0x39cff3&&(_0x334281=_0x66c948%0x4?_0x334281*0x40+_0x39cff3:_0x39cff3,_0x66c948++%0x4)?_0x2f6f26+=String['fromCharCode'](0xff&_0x334281>>(-0x2*_0x66c948&0x6)):0x0){_0x39cff3=_0x52a3dd['indexOf'](_0x39cff3);}for(let _0x2a4ca7=0x0,_0x4e211f=_0x2f6f26['length'];_0x2a4ca7<_0x4e211f;_0x2a4ca7++){_0x3c505c+='%'+('00'+_0x2f6f26['charCodeAt'](_0x2a4ca7)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x3c505c);};_0x1d39['zCDtQr']=_0x26d495,_0x1d39['gLVzhy']={},_0x1d39['vThYtI']=!![];}const _0x464361=_0x227514[0x0],_0x45f100=_0x1e263f+_0x464361,_0x48c180=_0x1d39['gLVzhy'][_0x45f100];return!_0x48c180?(_0x1d3981=_0x1d39['zCDtQr'](_0x1d3981),_0x1d39['gLVzhy'][_0x45f100]=_0x1d3981):_0x1d3981=_0x48c180,_0x1d3981;}(function(_0x5d4ed7,_0x13fc0f){const _0x3dd4ee=_0x1d39,_0x40651e=_0x5d4ed7();while(!![]){try{const _0x6da98a=parseInt(_0x3dd4ee(0x1e0))/0x1+-parseInt(_0x3dd4ee(0x205))/0x2*(parseInt(_0x3dd4ee(0x1e9))/0x3)+parseInt(_0x3dd4ee(0x1f7))/0x4*(parseInt(_0x3dd4ee(0x1e5))/0x5)+parseInt(_0x3dd4ee(0x1f4))/0x6+parseInt(_0x3dd4ee(0x20a))/0x7*(parseInt(_0x3dd4ee(0x1fc))/0x8)+parseInt(_0x3dd4ee(0x1e8))/0x9*(parseInt(_0x3dd4ee(0x1b6))/0xa)+-parseInt(_0x3dd4ee(0x1b7))/0xb*(parseInt(_0x3dd4ee(0x203))/0xc);if(_0x6da98a===_0x13fc0f)break;else _0x40651e['push'](_0x40651e['shift']());}catch(_0x8590ed){_0x40651e['push'](_0x40651e['shift']());}}}(_0x2275,0x83e88));var __importDefault=this&&this[_0x1184f5(0x1df)]||function(_0x2f6f26){const _0xb4e1bc=_0x1184f5;return _0x2f6f26&&_0x2f6f26[_0xb4e1bc(0x206)]?_0x2f6f26:{'default':_0x2f6f26};};Object[_0x1184f5(0x1c1)](exports,'__esModule',{'value':!![]}),exports[_0x1184f5(0x1db)]=void 0x0;const axios_1=__importDefault(require(_0x1184f5(0x1cf))),errors_1=require(_0x1184f5(0x1d5)),parse_api_error_1=require(_0x1184f5(0x1fa)),oauth_app_api_1=require(_0x1184f5(0x1b2));function trimBaseUrl(_0x3c505c){const _0x4df40f=_0x1184f5;return _0x3c505c[_0x4df40f(0x20c)]()['replace'](/\/+$/,'');}function resolveScope(_0x66c948){const _0x49dc0b=_0x1184f5;if(_0x66c948[_0x49dc0b(0x1d4)]?.['trim']())return _0x66c948['scope'][_0x49dc0b(0x20c)]();if(_0x66c948['scopes']?.[_0x49dc0b(0x208)])return _0x66c948[_0x49dc0b(0x1ba)]['filter'](Boolean)[_0x49dc0b(0x1ad)]('\x20');return undefined;}function _0x2275(){const _0x5b286f=['Bwf4qxr0zw1WDhm','t0f1DgGGyxbWignYzwrLBNrPywXZihjLCxvPCMvKicHHChbbCgLlzxKGB3iGyxbWu2vJCMv0kq','y29UBMvJDcbYzxf1AxjLCYbWCM92AwrLCG','t0f1DgGGCMvXDwvZDcbMywLSzwq','mtK0mZiYmdbuwuHmEvK','l3rVA2vUl2v4y2HHBMDL','mti4zMrPB2fc','x19LC01VzhvSzq','l29HDxrOl2fWChmV','BgvUz3rO','y29Kzq','mJy1ota5BwvUAuvV','A2v5CW','DhjPBq','CMvZB2X2zufWCeLK','AM9PBG','l3rVA2vU','zxH0zxjUywXFDxnLCL9Pza','uMvXDwvZDcbMywLSzwq6ia','CgfYC2vbCgLfCNjVCKnVzgu','lI90ExbLCY9Vyxv0Ac1HChaUyxbP','ywn0B3jFDg9Rzw5FDhLWzq','zxHJAgfUz2uGCMvXDwLYzxmGy29UBMvJDgLVBL9Pza','CMvHC29U','mZy2mZK5mgz4BLbbqq','mtfNtKvmBMS','y29UBMvJDgLVBNm','CMvSyxLFC3rHDgu','C2nVCgvZ','C2fTBf9Yzxf1zxn0','yxvKAwvUy2u','Dg9tDhjPBMC','Cg9ZDa','yxbWBgLJyxrPB24VANnVBG','l3jLDM9Rzq','zgvMAw5LuhjVCgvYDhK','q2XPB2rVDefWAuvYCM9Y','y29UBMvJDgLVBL9ZDg9YywDL','ChjVDMLKzxi','C3rHDhvZq29Kzq','l2fWChmV','yM9KEq','CMvKAxjLy3rFDxjP','C3vIAMvJDf90B2TLBG','zxHJAgfUz2uGCMvXDwLYzxmGy29Kzq','Cg9SBf9ZDgf0zq','rgv2AwnLigf1DgHVCML6yxrPB24GCg9SBcb0Aw1LzcbVDxq','yMfZzvvYBa','yxbWswq','yxHPB3m','revmrvrf','t0f1DgHbChbdBgLLBNqGCMvXDwLYzxmGyxbWswq','yxv0Ag9YAxPHDgLVBL91CMW','yxbWqxbPs2v5','C2nVCgu','lI9LCNjVCNm','DMfSAwrHDgvszxnWB25Zzq','r0vu','l2nVBM5Ly3rPB25ZlW','y29UBMvJDgLVBL9Pza','l2nVBM5Ly3q','t0f1DgHbChbdBgLLBNq','qMvHCMvYia','yNvPBgrtmLnizwfKzxjZ','zw50CMLLCW','x19PBxbVCNrezwzHDwX0','nJq3mZu3wLfVv2v1','l2nVBM5Ly3qVCg9SBa','AxnezxzPy2vbDxrOB3jPEMf0Aw9UugvUzgLUz0vYCM9Y','z2v0vg9Rzw4','y2XPB2rVDefWAuvYCM9YrNjVBuf4Aw9Z','ntvmwwnOwgG','C2v0','CMvXDwvZDgvKx3rVA2vUx3r5Cgu','ouruyNfvqG','mZa4ntjKrK1hwhC','yxbWu2vJCMv0','CgfYC2vbCgLfCNjVCK1LC3nHz2u','Cg9SBeLUDgvYDMfStxm','y29UBMvJDcbYzxf1AxjLCYbYzwrPCMvJDf91CMK','C3vIAMvJDf90B2TLBL90ExbL','ywn0B3jFDg9Rzw4','Cg9SBcbYzxf1AxjLCYbWB2XSx3n0yxrL','C3rHDgu','C2vHCMnOugfYyw1Z','CMvXDwvZDa','nti0mdiWohLLBM9hDW','CgfYyw1Z','y29UBMvJDgLVBKLKigLZihjLCxvPCMvK','mJi3oti4AwXmsLny','ue9tva','C3nVx2jPBMrPBMC','lI9ODhrWl3bHCNnLlwfWAs1LCNjVCG','zxHJAgfUz2u','nJrgyw1AuxK','l3jLzNjLC2G','zgvIDwC'];_0x2275=function(){return _0x5b286f;};return _0x2275();}function buildConnectQuery(_0x334281){const _0x57eb3f=_0x1184f5,_0x39cff3={'provider':_0x334281[_0x57eb3f(0x1c4)][_0x57eb3f(0x20c)](),'redirect_uri':_0x334281['redirect_uri'][_0x57eb3f(0x20c)]()},_0x239e7f=resolveScope(_0x334281);if(_0x239e7f)_0x39cff3[_0x57eb3f(0x1d4)]=_0x239e7f;if(_0x334281[_0x57eb3f(0x1f1)])_0x39cff3[_0x57eb3f(0x1f1)]=_0x334281[_0x57eb3f(0x1f1)];if(_0x334281[_0x57eb3f(0x1af)])_0x39cff3['external_user_id']=_0x334281[_0x57eb3f(0x1af)];if(_0x334281[_0x57eb3f(0x1c3)])_0x39cff3[_0x57eb3f(0x1c3)]=_0x334281[_0x57eb3f(0x1c3)];return _0x39cff3;}function buildConnectBody(_0x2a4ca7){const _0xe1d36=_0x1184f5,_0x4e211f={'provider':_0x2a4ca7[_0xe1d36(0x1c4)][_0xe1d36(0x20c)](),'redirect_uri':_0x2a4ca7[_0xe1d36(0x1c8)][_0xe1d36(0x20c)]()},_0x3e3eeb=resolveScope(_0x2a4ca7);if(_0x3e3eeb)_0x4e211f['scope']=_0x3e3eeb;if(_0x2a4ca7[_0xe1d36(0x1ba)]?.['length'])_0x4e211f[_0xe1d36(0x1ba)]=_0x2a4ca7[_0xe1d36(0x1ba)];if(_0x2a4ca7[_0xe1d36(0x1f1)])_0x4e211f[_0xe1d36(0x1f1)]=_0x2a4ca7[_0xe1d36(0x1f1)];if(_0x2a4ca7[_0xe1d36(0x1af)])_0x4e211f['external_user_id']=_0x2a4ca7['external_user_id'];if(_0x2a4ca7[_0xe1d36(0x1c3)])_0x4e211f['connection_storage']=_0x2a4ca7[_0xe1d36(0x1c3)];if(_0x2a4ca7['assertion'])_0x4e211f['assertion']=_0x2a4ca7['assertion'];if(_0x2a4ca7[_0xe1d36(0x1c9)])_0x4e211f[_0xe1d36(0x1c9)]=_0x2a4ca7[_0xe1d36(0x1c9)];if(_0x2a4ca7[_0xe1d36(0x1ee)])_0x4e211f[_0xe1d36(0x1ee)]=_0x2a4ca7['subject_token_type'];if(_0x2a4ca7[_0xe1d36(0x1e7)])_0x4e211f[_0xe1d36(0x1e7)]=_0x2a4ca7[_0xe1d36(0x1e7)];if(_0x2a4ca7[_0xe1d36(0x1ef)])_0x4e211f[_0xe1d36(0x1ef)]=_0x2a4ca7[_0xe1d36(0x1ef)];if(_0x2a4ca7['actor_token_type'])_0x4e211f['actor_token_type']=_0x2a4ca7[_0xe1d36(0x1b3)];if(_0x2a4ca7[_0xe1d36(0x1bc)])_0x4e211f['audience']=_0x2a4ca7[_0xe1d36(0x1bc)];return _0x4e211f;}function assertConnectInput(_0x3cc835){const _0x56f3c1=_0x1184f5;if(!_0x3cc835[_0x56f3c1(0x1c4)]?.[_0x56f3c1(0x20c)]())throw new errors_1[(_0x56f3c1(0x1c2))](_0x56f3c1(0x201));if(!_0x3cc835[_0x56f3c1(0x1c8)]?.[_0x56f3c1(0x20c)]())throw new errors_1[(_0x56f3c1(0x1c2))](_0x56f3c1(0x1ed));}function assertPollInput(_0xaf4bb0){const _0x13dc0b=_0x1184f5;if(!_0xaf4bb0[_0x13dc0b(0x1c4)]?.[_0x13dc0b(0x20c)]())throw new errors_1[(_0x13dc0b(0x1c2))]('poll\x20requires\x20provider');if(!_0xaf4bb0[_0x13dc0b(0x1cb)]?.['trim']())throw new errors_1[(_0x13dc0b(0x1c2))](_0x13dc0b(0x1f0));}function assertExchangeInput(_0x1f187b){const _0x178544=_0x1184f5;if(!_0x1f187b[_0x178544(0x209)]?.[_0x178544(0x20c)]())throw new errors_1['CliodotApiError'](_0x178544(0x1ca));if(!_0x1f187b[_0x178544(0x1d9)]?.[_0x178544(0x20c)]())throw new errors_1[(_0x178544(0x1c2))](_0x178544(0x1b4));}function assertConnectionId(_0x5765f4){const _0x54dcdb=_0x1184f5;if(!_0x5765f4?.[_0x54dcdb(0x20c)]())throw new errors_1[(_0x54dcdb(0x1c2))](_0x54dcdb(0x1f6));}function sleep(_0x5a6578){return new Promise(_0x1ddae6=>setTimeout(_0x1ddae6,_0x5a6578));}class OAuthAppClient{constructor(_0x5aea42){const _0x34a5ae=_0x1184f5;this['connect']={'start':async _0x441f72=>{const _0x3106a9=_0x1d39;assertConnectInput(_0x441f72);const _0x29979a=this[_0x3106a9(0x20d)](_0x441f72[_0x3106a9(0x1ce)]);return this[_0x3106a9(0x1f3)](_0x3106a9(0x1f8),'/apps/'+encodeURIComponent(_0x29979a)+_0x3106a9(0x1da),{'body':buildConnectBody(_0x441f72),'auth':![]});},'poll':async _0xe2158a=>{const _0x150698=_0x1d39;assertPollInput(_0xe2158a);const _0x2b324f=this[_0x150698(0x20d)](_0xe2158a[_0x150698(0x1ce)]),_0xfeb299=_0xe2158a[_0x150698(0x1ec)]??0x1388,_0x54d11a=_0xe2158a[_0x150698(0x1ff)]??0x78;for(let _0x375e0b=0x0;_0x375e0b<_0x54d11a;_0x375e0b+=0x1){try{return await this[_0x150698(0x1f3)]('POST',_0x150698(0x1c6)+encodeURIComponent(_0x2b324f)+_0x150698(0x1e1),{'body':{'provider':_0xe2158a['provider'][_0x150698(0x20c)](),'poll_state':_0xe2158a['poll_state'][_0x150698(0x20c)]()},'auth':![]});}catch(_0x950c7b){if(!(0x0,oauth_app_api_1[_0x150698(0x1e2)])(_0x950c7b)||_0x375e0b===_0x54d11a-0x1)throw _0x950c7b;await sleep(_0xfeb299);}}throw new errors_1[(_0x150698(0x1c2))](_0x150698(0x1cc));},'buildUrl':_0x32a851=>{const _0x3134f3=_0x1d39;assertConnectInput(_0x32a851);const _0x55c5f3=this[_0x3134f3(0x20d)](_0x32a851[_0x3134f3(0x1ce)]),_0x1bdfab=new URL(this[_0x3134f3(0x1cd)]+_0x3134f3(0x207)+encodeURIComponent(_0x55c5f3)+_0x3134f3(0x1da)),_0x3755a5=buildConnectQuery(_0x32a851);for(const [_0x392534,value]of Object[_0x3134f3(0x1de)](_0x3755a5)){_0x1bdfab[_0x3134f3(0x1f2)][_0x3134f3(0x1e6)](_0x392534,value);}return _0x1bdfab[_0x3134f3(0x1bd)]();},'isSamlPostBinding':_0x56e028=>{const _0x310a9b=_0x1d39;return _0x56e028[_0x310a9b(0x1f9)]===_0x310a9b(0x1be)&&!!_0x56e028[_0x310a9b(0x1bb)]&&!!_0x56e028[_0x310a9b(0x1b9)];},'buildSamlPostForm':_0x1e58c5=>{const _0x3f1667=_0x1d39;if(!_0x1e58c5['saml_request']||!_0x1e58c5[_0x3f1667(0x1b9)]||!_0x1e58c5[_0x3f1667(0x1d2)])return null;if(_0x1e58c5[_0x3f1667(0x1f9)]&&_0x1e58c5[_0x3f1667(0x1f9)]!==_0x3f1667(0x1be))return null;return{'action':_0x1e58c5['authorization_url'],'samlRequest':_0x1e58c5[_0x3f1667(0x1bb)],'relayState':_0x1e58c5[_0x3f1667(0x1b9)]};}},this[_0x34a5ae(0x1b8)]={'get':async _0x352943=>{const _0x5c664a=_0x34a5ae;return assertConnectionId(_0x352943),this['request'](_0x5c664a(0x1d7),_0x5c664a(0x1d8)+encodeURIComponent(_0x352943[_0x5c664a(0x20c)]()));},'getToken':async _0x1ba587=>{const _0x11c680=_0x34a5ae;return assertConnectionId(_0x1ba587),this[_0x11c680(0x1f3)](_0x11c680(0x1d7),_0x11c680(0x1d8)+encodeURIComponent(_0x1ba587[_0x11c680(0x20c)]())+_0x11c680(0x1ae));},'sync':async _0x55acc8=>{const _0x24647e=_0x34a5ae;return this[_0x24647e(0x1b8)][_0x24647e(0x1e3)](_0x55acc8);},'refresh':async _0x24bdf0=>{const _0x3a2362=_0x34a5ae;return assertConnectionId(_0x24bdf0),this[_0x3a2362(0x1f3)]('POST',_0x3a2362(0x1d8)+encodeURIComponent(_0x24bdf0[_0x3a2362(0x20c)]())+_0x3a2362(0x1fd));},'revoke':async(_0x202fb5,_0x556d0b)=>{const _0xe25d1d=_0x34a5ae;assertConnectionId(_0x202fb5);const _0x3ac169={};return _0x556d0b?.[_0xe25d1d(0x1b5)]?.[_0xe25d1d(0x20c)]()&&(_0x3ac169[_0xe25d1d(0x1b5)]=_0x556d0b[_0xe25d1d(0x1b5)][_0xe25d1d(0x20c)]()),this[_0xe25d1d(0x1f3)](_0xe25d1d(0x1f8),_0xe25d1d(0x1d8)+encodeURIComponent(_0x202fb5[_0xe25d1d(0x20c)]())+_0xe25d1d(0x1c0),{'body':Object[_0xe25d1d(0x20b)](_0x3ac169)[_0xe25d1d(0x208)]?_0x3ac169:undefined});},'delete':async _0x18d382=>{const _0x507274=_0x34a5ae;return assertConnectionId(_0x18d382),this[_0x507274(0x1f3)](_0x507274(0x1d0),'/connections/'+encodeURIComponent(_0x18d382['trim']()));}};if(!_0x5aea42['baseUrl']?.[_0x34a5ae(0x20c)]())throw new errors_1[(_0x34a5ae(0x1c2))]('OAuthAppClient\x20requires\x20baseUrl');if(!_0x5aea42['appId']?.['trim']())throw new errors_1['CliodotApiError'](_0x34a5ae(0x1d1));this[_0x34a5ae(0x1cd)]=trimBaseUrl(_0x5aea42[_0x34a5ae(0x1cd)]),this[_0x34a5ae(0x1ce)]=_0x5aea42[_0x34a5ae(0x1ce)][_0x34a5ae(0x20c)](),this[_0x34a5ae(0x1d3)]=_0x5aea42['appApiKey']?.[_0x34a5ae(0x20c)]()||undefined,this['appSecret']=_0x5aea42[_0x34a5ae(0x1ea)]?.[_0x34a5ae(0x20c)]()||undefined,this[_0x34a5ae(0x1fe)]=_0x5aea42[_0x34a5ae(0x1fe)]??![],this[_0x34a5ae(0x1cf)]=axios_1['default']['create']({'baseURL':this['baseUrl']+'/oauth','timeout':0x7530,'headers':{'Content-Type':_0x34a5ae(0x1bf)}});}[_0x1184f5(0x20d)](_0xcb7bb4){const _0x16780a=_0x1184f5;return(_0xcb7bb4?.['trim']()||this[_0x16780a(0x1ce)])['trim']();}[_0x1184f5(0x1dd)](){const _0x3b92d3=_0x1184f5;if(this[_0x3b92d3(0x1d3)])return{'Authorization':_0x3b92d3(0x1dc)+this[_0x3b92d3(0x1d3)]};if(this[_0x3b92d3(0x1ea)])return{'X-Cliodot-App-Id':this[_0x3b92d3(0x1ce)],'X-Cliodot-App-Secret':this['appSecret']};throw new errors_1[(_0x3b92d3(0x1c2))](_0x3b92d3(0x200));}async[_0x1184f5(0x1f3)](_0x57a968,_0x435062,_0x578e81){const _0x3c1151=_0x1184f5,_0x1c443d={};_0x578e81?.['auth']!==![]&&Object['assign'](_0x1c443d,this[_0x3c1151(0x1dd)]());try{const {data:_0x33d8cf}=await this['axios']({'method':_0x57a968,'url':_0x435062,'headers':_0x1c443d,'data':_0x578e81?.[_0x3c1151(0x1c7)],'params':_0x578e81?.[_0x3c1151(0x1f5)],'validateStatus':_0x578e81?.[_0x3c1151(0x1d6)]===![]?_0xfb9873=>_0xfb9873<0x1f4:undefined});if(_0x33d8cf?.['ok']===![]){const _0x124a55=_0x33d8cf[_0x3c1151(0x1c5)];throw new errors_1[(_0x3c1151(0x1c2))]((0x0,parse_api_error_1[_0x3c1151(0x1eb)])(_0x33d8cf)||_0x3c1151(0x202),{'data':_0x33d8cf,'code':(0x0,parse_api_error_1[_0x3c1151(0x1b1)])(_0x33d8cf),'status':_0x124a55===0x1ac?0x1ac:undefined});}return _0x33d8cf;}catch(_0x42d368){if(_0x42d368 instanceof errors_1[_0x3c1151(0x1c2)])throw _0x42d368;const _0xfb8eea=(0x0,errors_1[_0x3c1151(0x1e4)])(_0x42d368,_0x3c1151(0x1b0)+_0x57a968+'\x20'+_0x435062);throw _0xfb8eea;}}async[_0x1184f5(0x1fb)](_0x11cfbd){const _0x1f17fc=_0x1184f5;return assertExchangeInput(_0x11cfbd),this[_0x1f17fc(0x1f3)](_0x1f17fc(0x1f8),_0x1f17fc(0x204),{'body':{'code':_0x11cfbd[_0x1f17fc(0x209)][_0x1f17fc(0x20c)](),'connection_id':_0x11cfbd[_0x1f17fc(0x1d9)][_0x1f17fc(0x20c)]()}});}}exports['OAuthAppClient']=OAuthAppClient;
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthAppClient = void 0;
+const axios_1 = __importDefault(require("axios"));
+const errors_1 = require("./errors");
+const parse_api_error_1 = require("./http/parse-api-error");
+const cliodot_request_1 = require("./http/cliodot-request");
+const oauth_app_api_1 = require("./types/oauth-app.api");
+function trimBaseUrl(url) {
+    return url.trim().replace(/\/+$/, "");
+}
+function resolveScope(input) {
+    if (input.scope?.trim()) {
+        return input.scope.trim();
+    }
+    if (input.scopes?.length) {
+        return input.scopes.filter(Boolean).join(" ");
+    }
+    return undefined;
+}
+function buildConnectQuery(input) {
+    const query = {
+        provider: input.provider.trim(),
+        redirect_uri: input.redirect_uri.trim(),
+    };
+    const scope = resolveScope(input);
+    if (scope)
+        query.scope = scope;
+    if (input.state)
+        query.state = input.state;
+    if (input.external_user_id)
+        query.external_user_id = input.external_user_id;
+    if (input.connection_storage)
+        query.connection_storage = input.connection_storage;
+    return query;
+}
+function buildConnectBody(input) {
+    const body = {
+        provider: input.provider.trim(),
+        redirect_uri: input.redirect_uri.trim(),
+    };
+    const scope = resolveScope(input);
+    if (scope)
+        body.scope = scope;
+    if (input.scopes?.length)
+        body.scopes = input.scopes;
+    if (input.state)
+        body.state = input.state;
+    if (input.external_user_id)
+        body.external_user_id = input.external_user_id;
+    if (input.connection_storage)
+        body.connection_storage = input.connection_storage;
+    if (input.assertion)
+        body.assertion = input.assertion;
+    if (input.subject_token)
+        body.subject_token = input.subject_token;
+    if (input.subject_token_type)
+        body.subject_token_type = input.subject_token_type;
+    if (input.requested_token_type)
+        body.requested_token_type = input.requested_token_type;
+    if (input.actor_token)
+        body.actor_token = input.actor_token;
+    if (input.actor_token_type)
+        body.actor_token_type = input.actor_token_type;
+    if (input.audience)
+        body.audience = input.audience;
+    return body;
+}
+function assertConnectInput(input) {
+    if (!input.provider?.trim()) {
+        throw new errors_1.CliodotApiError("connect requires provider");
+    }
+    if (!input.redirect_uri?.trim()) {
+        throw new errors_1.CliodotApiError("connect requires redirect_uri");
+    }
+}
+function assertPollInput(input) {
+    if (!input.provider?.trim()) {
+        throw new errors_1.CliodotApiError("poll requires provider");
+    }
+    if (!input.poll_state?.trim()) {
+        throw new errors_1.CliodotApiError("poll requires poll_state");
+    }
+}
+function assertExchangeInput(input) {
+    if (!input.code?.trim()) {
+        throw new errors_1.CliodotApiError("exchange requires code");
+    }
+    if (!input.connection_id?.trim()) {
+        throw new errors_1.CliodotApiError("exchange requires connection_id");
+    }
+}
+function assertConnectionId(connectionId) {
+    if (!connectionId?.trim()) {
+        throw new errors_1.CliodotApiError("connectionId is required");
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+class OAuthAppClient {
+    constructor(config) {
+        this.connect = {
+            start: async (input) => {
+                assertConnectInput(input);
+                const appId = this.resolveAppId(input.appId);
+                return this.request("POST", `/apps/${encodeURIComponent(appId)}/connect`, { body: buildConnectBody(input), auth: false });
+            },
+            poll: async (input) => {
+                assertPollInput(input);
+                const appId = this.resolveAppId(input.appId);
+                const intervalMs = input.pollIntervalMs ?? 5000;
+                const maxAttempts = input.maxAttempts ?? 120;
+                for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+                    try {
+                        return await this.request("POST", `/apps/${encodeURIComponent(appId)}/connect/poll`, {
+                            body: {
+                                provider: input.provider.trim(),
+                                poll_state: input.poll_state.trim(),
+                            },
+                            auth: false,
+                        });
+                    }
+                    catch (err) {
+                        if (!(0, oauth_app_api_1.isDeviceAuthorizationPendingError)(err) || attempt === maxAttempts - 1) {
+                            throw err;
+                        }
+                        await sleep(intervalMs);
+                    }
+                }
+                throw new errors_1.CliodotApiError("Device authorization poll timed out");
+            },
+            buildUrl: (input) => {
+                assertConnectInput(input);
+                const appId = this.resolveAppId(input.appId);
+                const url = new URL(`${this.baseUrl}/oauth/apps/${encodeURIComponent(appId)}/connect`);
+                const query = buildConnectQuery(input);
+                for (const [key, value] of Object.entries(query)) {
+                    url.searchParams.set(key, value);
+                }
+                return url.toString();
+            },
+            isSamlPostBinding: (response) => {
+                return response.sso_binding === "post" && !!response.saml_request && !!response.relay_state;
+            },
+            buildSamlPostForm: (response) => {
+                if (!response.saml_request || !response.relay_state || !response.authorization_url) {
+                    return null;
+                }
+                if (response.sso_binding && response.sso_binding !== "post") {
+                    return null;
+                }
+                return {
+                    action: response.authorization_url,
+                    samlRequest: response.saml_request,
+                    relayState: response.relay_state,
+                };
+            },
+        };
+        this.connections = {
+            get: async (connectionId) => {
+                assertConnectionId(connectionId);
+                return this.request("GET", `/connections/${encodeURIComponent(connectionId.trim())}`);
+            },
+            getToken: async (connectionId) => {
+                assertConnectionId(connectionId);
+                return this.request("GET", `/connections/${encodeURIComponent(connectionId.trim())}/token`);
+            },
+            sync: async (connectionId) => {
+                return this.connections.getToken(connectionId);
+            },
+            refresh: async (connectionId) => {
+                assertConnectionId(connectionId);
+                return this.request("POST", `/connections/${encodeURIComponent(connectionId.trim())}/refresh`);
+            },
+            revoke: async (connectionId, input) => {
+                assertConnectionId(connectionId);
+                const body = {};
+                if (input?.reason?.trim()) {
+                    body.reason = input.reason.trim();
+                }
+                return this.request("POST", `/connections/${encodeURIComponent(connectionId.trim())}/revoke`, { body: Object.keys(body).length ? body : undefined });
+            },
+            delete: async (connectionId) => {
+                assertConnectionId(connectionId);
+                return this.request("DELETE", `/connections/${encodeURIComponent(connectionId.trim())}`);
+            },
+        };
+        if (!config.baseUrl?.trim()) {
+            throw new errors_1.CliodotApiError("OAuthAppClient requires baseUrl");
+        }
+        if (!config.appId?.trim()) {
+            throw new errors_1.CliodotApiError("OAuthAppClient requires appId");
+        }
+        this.baseUrl = trimBaseUrl(config.baseUrl);
+        this.appId = config.appId.trim();
+        this.appApiKey = config.appApiKey?.trim() || undefined;
+        this.appSecret = config.appSecret?.trim() || undefined;
+        this.environment = config.environment;
+        this.debug = config.debug ?? false;
+        this.axios = axios_1.default.create({
+            baseURL: `${this.baseUrl}/oauth`,
+            timeout: 30000,
+            headers: { "Content-Type": "application/json" },
+        });
+    }
+    resolveAppId(appId) {
+        return (appId?.trim() || this.appId).trim();
+    }
+    buildS2SHeaders() {
+        if (this.appApiKey) {
+            return (0, cliodot_request_1.applyEnvironmentHeader)({ Authorization: `Bearer ${this.appApiKey}` }, this.environment);
+        }
+        if (this.appSecret) {
+            return (0, cliodot_request_1.applyEnvironmentHeader)({
+                "X-Cliodot-App-Id": this.appId,
+                "X-Cliodot-App-Secret": this.appSecret,
+            }, this.environment);
+        }
+        throw new errors_1.CliodotApiError("OAuth app credentials required (appApiKey or appSecret)");
+    }
+    async request(method, path, options) {
+        const headers = {};
+        if (options?.auth !== false) {
+            Object.assign(headers, this.buildS2SHeaders());
+        }
+        try {
+            const { data } = await this.axios({
+                method,
+                url: path,
+                headers,
+                data: options?.body,
+                params: options?.params,
+                validateStatus: options?.validateResponse === false
+                    ? (status) => status < 500
+                    : undefined,
+            });
+            if (data?.ok === false) {
+                const status = data.statusCode;
+                throw new errors_1.CliodotApiError((0, parse_api_error_1.parseApiErrorMessage)(data) || "OAuth request failed", {
+                    data,
+                    code: (0, parse_api_error_1.parseApiErrorCode)(data),
+                    status: status === 428 ? 428 : undefined,
+                });
+            }
+            return data;
+        }
+        catch (err) {
+            if (err instanceof errors_1.CliodotApiError) {
+                throw err;
+            }
+            const apiErr = (0, errors_1.cliodotApiErrorFromAxios)(err, `Request failed: ${method} ${path}`);
+            throw apiErr;
+        }
+    }
+    async exchange(input) {
+        assertExchangeInput(input);
+        return this.request("POST", "/token/exchange", {
+            body: {
+                code: input.code.trim(),
+                connection_id: input.connection_id.trim(),
+            },
+        });
+    }
+}
+exports.OAuthAppClient = OAuthAppClient;

package/dist/ProviderServicesClient.d.ts

@@ -0,0 +1,24 @@
+import { type CliodotFail, type CliodotMethodResult } from "./http/cliodot-result";
+import type { ProviderCatalogResponse, ProviderExecuteInput, ProviderExecuteResult, ProviderSdkTypesArtifact, ProviderServicesClientConfig } from "./types/provider-services.api";
+export declare class ProviderServicesClient<TCatalog = any> {
+    private readonly baseUrl;
+    private readonly appId;
+    private readonly apiKey?;
+    private readonly appSecret?;
+    private readonly environment?;
+    private readonly axios;
+    private readonly configError;
+    readonly debug: boolean;
+    readonly api: TCatalog;
+    constructor(config: ProviderServicesClientConfig);
+    /**
+     * Execute a catalog operation. Pass `provider` to pin a binding when routing allows it.
+     */
+    execute<TResult = Record<string, unknown>>(input: ProviderExecuteInput): Promise<ProviderExecuteResult<TResult> | CliodotFail>;
+    catalog(): Promise<CliodotMethodResult<ProviderCatalogResponse>>;
+    downloadTypes(): Promise<CliodotMethodResult<ProviderSdkTypesArtifact>>;
+    private asProxy;
+    private buildAuthHeaders;
+    private request;
+}
+//# sourceMappingURL=ProviderServicesClient.d.ts.map

package/dist/ProviderServicesClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProviderServicesClient.d.ts","sourceRoot":"","sources":["../src/ProviderServicesClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAGzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EAEpB,qBAAqB,EACrB,wBAAwB,EAExB,4BAA4B,EAC7B,MAAM,+BAA+B,CAAC;AAsCvC,qBAAa,sBAAsB,CAAC,QAAQ,GAAG,GAAG;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,SAAgB,KAAK,EAAE,OAAO,CAAC;IAC/B,SAAgB,GAAG,EAAE,QAAQ,CAAC;gBAElB,MAAM,EAAE,4BAA4B;IA2BhD;;OAEG;IACH,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC;IAmBxD,OAAO,IAAI,OAAO,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;IAI1D,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;IAW7E,OAAO,CAAC,OAAO;IAoCf,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,OAAO;CAiBhB"}

package/dist/ProviderServicesClient.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderServicesClient = void 0;
+const create_client_1 = require("./http/create-client");
+const cliodot_request_1 = require("./http/cliodot-request");
+const cliodot_result_1 = require("./http/cliodot-result");
+function trimBaseUrl(url) {
+    return url.trim().replace(/\/+$/, "");
+}
+function isExecuteResult(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const obj = value;
+    return (typeof obj.service === "string" &&
+        typeof obj.operation === "string" &&
+        Array.isArray(obj.attempts));
+}
+function normalizeExecuteResult(data, status) {
+    if (!isExecuteResult(data))
+        return null;
+    if (status === 502 || data.ok === false) {
+        const error = data.error;
+        return {
+            ...data,
+            ok: false,
+            error: {
+                code: error?.code || cliodot_result_1.SDK_ERROR.REQUEST_FAILED,
+                message: error?.message || "Provider execute failed",
+            },
+        };
+    }
+    if (data.ok === true) {
+        return data;
+    }
+    return { ...data, ok: true };
+}
+class ProviderServicesClient {
+    constructor(config) {
+        this.configError = (0, cliodot_result_1.resolveConfigError)([
+            {
+                valid: !!config.baseUrl?.trim(),
+                message: "ProviderServicesClient requires baseUrl",
+            },
+            {
+                valid: !!config.appId?.trim(),
+                message: "ProviderServicesClient requires appId",
+            },
+        ]);
+        this.baseUrl = trimBaseUrl(config.baseUrl || "");
+        this.appId = config.appId?.trim() || "";
+        this.apiKey =
+            config.apiKey?.trim() || config.appApiKey?.trim() || undefined;
+        this.appSecret = config.appSecret?.trim() || undefined;
+        this.environment = config.environment;
+        this.debug = config.debug ?? false;
+        this.axios = (0, create_client_1.createCliodotAxios)({
+            baseURL: `${this.baseUrl}/provider`,
+            timeout: config.timeoutMs ?? 60000,
+            headers: { "Content-Type": "application/json" },
+            validateStatus: (status) => status === 200 || status === 502,
+        });
+        this.api = this.asProxy();
+    }
+    /**
+     * Execute a catalog operation. Pass `provider` to pin a binding when routing allows it.
+     */
+    execute(input) {
+        const serviceError = (0, cliodot_result_1.resolveRequiredString)(input?.service, "service");
+        if (serviceError)
+            return Promise.resolve(serviceError);
+        const operationError = (0, cliodot_result_1.resolveRequiredString)(input?.operation, "operation");
+        if (operationError)
+            return Promise.resolve(operationError);
+        const body = {
+            service: input.service.trim(),
+            operation: input.operation.trim(),
+            input: input.input ?? {},
+        };
+        if (input.version?.trim())
+            body.version = input.version.trim();
+        if (input.provider?.trim())
+            body.provider = input.provider.trim();
+        if (input.idempotency_key?.trim()) {
+            body.idempotency_key = input.idempotency_key.trim();
+        }
+        return this.request("POST", "/v1/execute", body);
+    }
+    catalog() {
+        return this.request("GET", "/v1/catalog");
+    }
+    async downloadTypes() {
+        const result = await this.request("GET", "/v1/types");
+        if ((0, cliodot_result_1.isCliodotFail)(result))
+            return result;
+        return {
+            ok: true,
+            typescript: result.typescript,
+            filename: result.filename,
+            export_name: result.export_name,
+        };
+    }
+    asProxy(path = []) {
+        const client = this;
+        const callable = (...args) => {
+            if (path.length !== 2) {
+                return Promise.resolve((0, cliodot_result_1.cliodotValidationFail)("Provider fluent calls are service.operation(input, opts?)"));
+            }
+            const [service, operation] = path;
+            const input = args[0] ?? {};
+            const opts = args[1] || {};
+            return client.execute({
+                service,
+                operation,
+                input,
+                version: opts.version,
+                provider: opts.provider,
+                idempotency_key: opts.idempotency_key,
+            });
+        };
+        return new Proxy(callable, {
+            get(_target, prop) {
+                if (typeof prop === "symbol")
+                    return undefined;
+                if (prop === "then")
+                    return undefined;
+                if (prop === "toString")
+                    return () => "[ProviderServicesClient.api]";
+                return client.asProxy([...path, String(prop)]);
+            },
+            apply(_target, _thisArg, argArray) {
+                return callable(...(argArray || []));
+            },
+        });
+    }
+    buildAuthHeaders() {
+        return (0, cliodot_request_1.resolveBearerAuthHeaders)({
+            appId: this.appId,
+            apiKey: this.apiKey,
+            appSecret: this.appSecret,
+            environment: this.environment,
+            missingMessage: "Provider app credentials required (apiKey/appApiKey or appSecret)",
+        });
+    }
+    request(method, path, body) {
+        return (0, cliodot_request_1.executeCliodotRequest)({
+            configError: this.configError,
+            authHeaders: this.buildAuthHeaders(),
+            axios: this.axios,
+            method,
+            path,
+            body,
+            validateStatus: (status) => status === 200 || status === 502,
+            passThrough: (data, status) => normalizeExecuteResult(data, status),
+            fallbackMessage: `Request failed: ${method} ${path}`,
+        });
+    }
+}
+exports.ProviderServicesClient = ProviderServicesClient;

package/dist/Surface.d.ts

@@ -6,6 +6,8 @@ export interface SurfaceConfig {
     apiKeyHeader?: string;
     fetchSurface?: boolean;
     version?: string;
+    /** Pin project env bag for connector auth templates. Omit to follow the project switch. */
+    environment?: "dev" | "prod" | "development" | "production";
 }
 export interface SurfaceOp {
     id: string;

package/dist/Surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Surface.d.ts","sourceRoot":"","sources":["../src/Surface.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,GAAG,EAAE,SAAS,EAAE,CAAC;CAClB;AAoQD,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,QAAQ,GAAG,GAAG,IAAI,QAAQ,GAAG,cAAc,CAAC;AAEtE,KAAK,kBAAkB,GAAG;IACxB,KAAK,QAAQ,GAAG,GAAG,EAAE,MAAM,EAAE,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;CACtE,CAAC;AAEF,eAAO,MAAM,OAAO,EAMJ,kBAAkB,CAAC"}
+{"version":3,"file":"Surface.d.ts","sourceRoot":"","sources":["../src/Surface.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;CAC7D;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,GAAG,EAAE,SAAS,EAAE,CAAC;CAClB;AAwSD,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,QAAQ,GAAG,GAAG,IAAI,QAAQ,GAAG,cAAc,CAAC;AAEtE,KAAK,kBAAkB,GAAG;IACxB,KAAK,QAAQ,GAAG,GAAG,EAAE,MAAM,EAAE,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;CACtE,CAAC;AAEF,eAAO,MAAM,OAAO,EAMJ,kBAAkB,CAAC"}